Using PSRule with Bicep parameter file, no rules processed as expected #2678
-
|
Hi @BernieWhite Do you see what kind of configuration mistake that has been done here? Action: # Run Well-Architected Framework to validate the content of the Bicep deployment file.
- name: Validate deployment with Well-Architected Framework
uses: microsoft/ps-rule@main
with:
inputType: inputPath
inputPath: ${{ inputs.workingDirectory }}/parameters/main.${{ inputs.environment }}.bicepparam
modules: PSRule.Rules.Azure
baseline: Azure.All
outputFormat: Sarif
outputPath: reports/ps-rule-results.sarif
summary: trueConfiguration file: #
# PSRule for Azure configuration
#
# Please see the documentation for all configuration options:
# https://aka.ms/ps-rule-azure
# Use rules from the following modules/
include:
module:
- "PSRule.Rules.Azure"
# Require a minimum version of modules that include referenced baseline.
requires:
PSRule: "@pre >=2.9.0"
PSRule.Rules.Azure: "@pre >=1.33.0"
output:
culture:
- "en-US"
execution:
# Ignore warnings for resources and objects that don't have any rules.
unprocessedObject: Ignore
configuration:
# Enable expansion for Bicep source files.
AZURE_BICEP_FILE_EXPANSION: true
# Set the Bicep parameter expansion configuration option to enable expansion of Azure Bicep parameter files (.bicepparam).
AZURE_BICEP_PARAMS_FILE_EXPANSION: true
# Set timeout for expanding Bicep source files.
AZURE_BICEP_FILE_EXPANSION_TIMEOUT: 30
# The default AZURE_SUBSCRIPTION configuration option.
AZURE_SUBSCRIPTION:
displayName: x-platform-001
# This option is used for specify the base branch for pull requests.
# When evaluating changes files only PSRule uses this option for comparison with the current branch.
repository:
baseRef: main
input:
# By default, objects read from file using inputPath will be skipped if the file path has been ignored.
# When set to true, additionally objects with a source path that has been ignored will be skipped.
ignoreObjectSource: true
# By default, PSRule will process all files within an input path.
ignoreUnchangedPath: true
pathIgnore:
# Ignore other files in the repository.
- '**'
# Include deployment files.
- '!deployments/**/*.bicepparam'
- '!deployments/**/main.bicep'Bicep file and parameter file: targetScope = 'managementGroup'
@description('Provide a name for the alias. This name will also be the display name of the subscription.')
param subscriptionAliasName string
@description('Provide the full resource ID of billing scope to use for subscription creation.')
param billingScope string
resource subscriptionAlias 'Microsoft.Subscription/aliases@2021-10-01' = {
scope: tenant()
name: subscriptionAliasName
properties: {
workload: 'Production'
displayName: subscriptionAliasName
billingScope: billingScope
}
using '../main.bicep'
param billingScope = '/providers/Microsoft.Billing/billingAccounts/07068764-73c0-xxx/billingProfiles/xxx/invoiceSections/xxx
param subscriptionAliasName = 'd-org-001'Workflow run from main branch: Thanks in advance. |
Beta Was this translation helpful? Give feedback.
Replies: 4 comments 9 replies
-
|
@BenjaminEngeset The Using See: https://azure.github.io/PSRule.Rules.Azure/troubleshooting/#no-rules-or-no-azure-resources-are-found |
Beta Was this translation helpful? Give feedback.
-
|
@BernieWhite Thanks. I have changed it to be # Run Well-Architected Framework to validate the content of the Bicep deployment file.
- name: Validate deployment with Well-Architected Framework
uses: microsoft/ps-rule@main
with:
inputType: repository
inputPath: ${{ inputs.workingDirectory }}/parameters/main.${{ inputs.environment }}.bicepparam
modules: PSRule.Rules.Azure
baseline: Azure.All
outputFormat: Sarif
outputPath: reports/ps-rule-results.sarif
summary: true |
Beta Was this translation helpful? Give feedback.
-
|
@BenjaminEngeset Next thought would be to double check that the |
Beta Was this translation helpful? Give feedback.
-
@BernieWhite Thanks, I have tried both actually without success. Still no rules are being processed.
Current repository structure: Do you have an additional thing I can check? The |
Beta Was this translation helpful? Give feedback.
-
|
@BenjaminEngeset How are you using the When this option set to To have files scanned when |
Beta Was this translation helpful? Give feedback.
-
@BernieWhite I have been using the Now I'm going to use PSRule for deployment repository, where I want the same behavior, but I'm also going to scan it after it's merged into main branch, because each deployment file should have PSRule scanning before deployment to the according environment. I have configured |
Beta Was this translation helpful? Give feedback.
-
|
@BernieWhite That didn't work, but commenting out the path ignore did the trick. The file is analyzed as expected. What do you think would be the next step here? |
Beta Was this translation helpful? Give feedback.
-
|
@BenjaminEngeset Let's try removing the |
Beta Was this translation helpful? Give feedback.
-
|
@BernieWhite Looks like I'm also wondering if the |
Beta Was this translation helpful? Give feedback.
-
|
@BenjaminEngeset Thanks for confirming. For Bicep this option should have no effect, because the file path and object source path are the same. I'd suggest it's a bug, but since it has not additional functionality in Bicep currently, it's safe to unconfigure. Logged as microsoft/PSRule#1753 This option use used to help detect changed files, it's used for comparisons. If not set, PSRule will attempt to detect the base path however there is cases when detection is not possible. So setting this option is recommended with |
Beta Was this translation helpful? Give feedback.
-
|
Should we mark this as answered @BernieWhite? |
Beta Was this translation helpful? Give feedback.
-
|
Yes please. |
Beta Was this translation helpful? Give feedback.
@BenjaminEngeset Thanks for confirming. For Bicep this option should have no effect, because the file path and object source path are the same. I'd suggest it's a bug, but since it has not additional functionality in Bicep currently, it's safe to unconfigure.
Logged as microsoft/PSRule#1753
This option use used to help detect changed files, it's used for comparisons. If not set, PSRule will attempt to detect the base path however there is cases when detection is not possible. So setting this option is recommended with
ignoreUnchangedPath=true.